Government toughens up online privacy rules for kids’ websites

Apps aimed at kids need to limit data gathering or face legal action.

There is currently no federal online privacy law, which makes it essentially impossible for government agencies like the Federal Trade Commission to go after Internet companies unless they violate their own published privacy policies.

One area where that's not true is when it comes to kids. When dealing with children under 13 years old, online service companies can't collect personal information (like e-mail addresses) without explicit permission from a parent or guardian. The FTC can prosecute companies that gather kids' data without parental consent. The commission has used that power, too, against both small developers and big companies like Sony.

Technology, and the terms used to regulate it, change over time. The Children's Online Privacy Protection Act (or COPPA) was passed in 1998, and since then it has become unclear exactly what is or isn't allowed. A new set of rules published by the FTC today doesn't change existing law, but it should lend more clarity to enforcing privacy protection for kids in the changing tech world, especially when dealing with location technologies and mobile apps.

Specifically, the new rules:

Make clear that the "personal information" that can't be collected without parental consent includes geolocation information, photographs, and videos

Make clear that third parties (like advertising networks) must also comply with COPPA

Close a loophole that allowed kids' information to be collected via plug-ins without parental notice

Clarify that "persistent identifiers" are also protected information, like IP addresses and mobile device IDs

Require that websites aimed at kids have "reasonable procedures" for data retention and deletion

The new rules are needed in order to stop behavioral marketers from building "massive profiles" of children using identifiers like mobile device IDs. "Some companies, especially ad networks, have an insatiable appetite for information, even from kids," said Leibowitz.

Leeway will be given to sites or apps that aren't explicitly aimed at kids.

The new rules won't hurt online business, including businesses based on advertising, he said. Ads that aren't "behavioral," or targeted using user data, won't be affected.

"Under this rule, advertisers and ad networks can continue to advertise even on sites directed to children," said Leibowitz. "Business models that depend on advertising will continue to thrive. The only limits are on behavioral advertising."

One of the proponents of the new rules, Sen. John Rockefeller (D-WV), said he would like to go further and pass federal legislation making sure the "Do Not Track" options now installed on Web browsers have some actual legal teeth to them. But the political reality is that he can't do that right now because of opposition from the business community.

"I'd like to see a Do Not Track bill passed this afternoon, but we can't do that," said Rockefeller. "So we've got to build towards it." He continues to be "baffled" by opposition from the Chamber of Commerce, he said. "It's very depressing."